Security: fix session leaks, OAuth redirect validation, host header injection#29

Merged

thekevinm merged 4 commits intodevelopfrom

2026-04-security-scan

Apr 22, 2026

Commits on Mar 24, 2026

Merge pull request #20 from dreamfactorysoftware/develop
oleksandrkits
authored

Commits on Mar 27, 2026

Merge pull request #27 from dreamfactorysoftware/develop
oleksandrkits
authored

Commits on Apr 10, 2026

Security: fix CORS, session leaks, OAuth redirect, and host header injection
nicdavidson
committed
Revert CORS to permissive — MCP clients are inherently external
nicdavidson
committed